Show HN: Voice Age Verification | Hacker News Reader

Show HN: Voice Age Verification

agewarden.ai

8 pointswentw0rth33 comments

I miss the old web. As a kid I could type in "a/s/l" in AOL messenger and chat with someone my own age, without worrying about the dangers that lurk on the web today.

After seeing what happened to Omegle, a question stuck: is there a simple way to do age verification that both keeps people safe and doesn't contribute to a surveillance state?

After a year of hard work, that question resulted in AGEWARDEN. Each part of the service puts people first. No tracking, nothing stored (it's more difficult these days to NOT collect data :smh:).

Please give it a try if you have a moment https://agewarden.ai/demo. Feedback is very much welcomed.

Open articleView on HN

I think that if we are considering technical solutions to the social problems here, the answer is well understood by professionals working in age/ID verification. You allow someone to perform a more thorough check verifying your age and identity (such as the government or your smartphone vendor), and then you use a privacy preserving protocol to provide a proof of whatever attribute (such as age) you are trying to verify in the absence of the remaining personal data. This can be as simple as exposing a "is age over {16, 18, 19, 21, 25}" api in the OS or browser, or as complex as a ZKP as needed. What doesn't work is requiring each service to independently perform verification which leads to a massive expansion in the proliferation of personal data and is incompatible with the modern approaches to data protection.

This is a solution that hopefully will cease to be relevant as soon as the remaining infrastructure is finished.

Even more so considering that most, if not all countries already have age-verification infrastructure in-place for selling alcohol and tobacco (and other goods). Why not piggy-back on this? Go to a kiosk/shop selling controlled goods, pay a small fee to the vendor to get a one-use verification code that attests your age.

Love it. We've been playing around with other ideas that are not web related. As the tech improves, less data will be needed to infer age. Strange now, but setting up a microphone at a kiosk or providing a widget-less API for broader use-cases, is not a stretch for piggy-backing. Thank you for the comment.

Making someone get in the car and go somewhere to be able to use a website is a rough ask.

Just a thought, maybe I could get a one-time code from my secretary of state website that provides only the age bracket information to the service provider’s age verification broker.

- Don’t need to go anywhere.

- Doesn’t provide age information to the service provider beyond “yes/no, allowed”.

- Doesn’t tell the agency who knows your age what service you’re trying to use.

- Broker doesn’t know any actual identity or service details, and can ideally be ZDR

This is literally the purpose of most of the European EUDI wallets, but automated. You create an account with whatever part of government handles ID, you get a "wallet", and then services can ask you to share minimised data from the wallet. This can be implemented in such a way that the government doesn't know who requested and the requester doesn't learn anything about you other than the minimum covering set of attributes required.

> You allow someone to perform a more thorough check verifying your age and identity (such as the government or your smartphone vendor)...

Some people may be okay with that, others may want to browse the web in privacy.

> What doesn't work is requiring each service to independently perform verification which leads to a massive expansion in the proliferation of personal data.

And that's the AGEWARDEN difference, we keep no data, literally. I don't even know who's visited the site. Send your AI to the FAQ page for analysis: https://agewarden.ai/faq, I want to make sure we clear your bar.

While you're 100% correct, I'm not holding my breath on that remaining infrastructure being available anytime soon.

I was expecting, at the very least, to see Apple make their App Store 18+ checks available to developers at WWDC this year. Yet, there's still nothing except the self-reported (useless) "Declared Age Range." Apple has the best integration story of all of them, and could bring it to their entire ecosystem (native iOS apps, mobile Safari, all of MacOS), yet they haven't. Why?

Also, nothing comes to mind regarding browsers, android devices, or non-mobile devices. As far as I'm aware, no one seems to be in a rush to make this available. With non-Apple hardware, I can see it being trickier, but still, I haven't seen many (any) attempts. Why?

It probably doesn't help that many don't see the difference between "deep-state surveillance digital ID verification" and privacy-preserving ZKPs to verify age.

> the difference between "deep-state surveillance digital ID verification" and privacy-preserving ZKPs to verify age

Agreed.

> Also, nothing comes to mind regarding browsers, android devices, or non-mobile devices. As far as I'm aware, no one seems to be in a rush to make this available.

Exactly, it doesn't benefit companies to NOT know as much about you as possible. Reminded me of this: https://old.reddit.com/r/linux/comments/1rshc1f/i_traced_2_b...

I'll be honest: I don't have experience with audio stuff/age verification, but wouldn't it be far easier to bypass this than even face (live video) verification, let alone full KYC with ID? At that point it's not that much better than a "I'm over 18" button, or am I missing something?

EDIT: The website itself partially answers my question:

> Self-declaration, the "I am over 18" checkbox, is explicitly prohibited by every major regulator in the UK, EU, and Australia.

But then:

> Facial scanning works, but it builds infrastructure that outlasts the check. A system that estimates your age today can identify you tomorrow. Platforms that rolled it out met immediate backlash and reversals. Users do not trust platforms with their face.

How would we trust your platform to not store voice fingerprints, then?

(On a side note, all descriptions all LLM-written, but that's expected in 2026)

Thanks for the comment/question:

> wouldn't it be far easier to bypass this than even face (live video) verification... or am I missing something?

Missing the experience of learning just how much information is in a clip of audio; replay/synthetic attack mitigation is baked in, and more cost-effective to run vs. video, and less creepy.

The mission: make the process easy (and inexpensive) as possible so that people can be verified at scale, without giving away their personal data and being the product.

Post edit/updated, let me track:

> How would we trust your platform to not store voice fingerprints, then?

This is a good question. Other than having it be more expensive to keep this data, and if it were true, destroy the company whose core tenant is literally that... you can't.

If you have suggestions for an independent audit, more than happy to add that to our stack where applicable.

When I say it's hard to not collect data, woof. Any fresh AWS account just LOVES to slurp it up by default.

ASL is literally a meme that everyone is an old male predator on the internet.

LOL, it was BEFORE the sketchy times :')

at first I was a bit shocked at the price of $0.10/verification (having never implemented KYC before). But after looking it up, more traditional KYC/age verification services cost up to a couple euros per scan which is crazy to me. Never thought about the cost of such systems before.

That's the nice thing about audio temporal vs. video, much cheaper.

How do you distinguish between a live person and a high-fidelity recording?

Good question: regardless of the recording instrument (our lab has many microphones of varying degrees from low > high fidelity), a live person vs. recordings that are played back carry a unique signature.

I (41 man with very deep voice) told it in a higher then normal voice that I was a kid, and it said I was under 18. I suspect if I was a kid that used a deep voice to say that I was an adult it would also fool it.

No offense but this is probably worthless is an adversarial environment.

Reliable Age Verification is nearly impossible and your antecdote gives weight to that assertion. Your comment brought my mind to voice actors. They easily change their voices. Deep fakes also come to mind.

So what is a solution? Parents. What about those that don't have parents? Surely they have guardians. Adults who guide the next generation instead of delegating them to technology.

> Your comment brought my mind to voice actors. They easily change their voices. Deep fakes also come to mind.

Voice actors, deep fakes, replay attacks (recordings from a TV/computer/phone) - mitigated. As in my earlier comment where teen voices have a signature, these all have unique signatures as well. The ongoing part is staying up-to-date with the latest synthetic (deep fakes/AI generated) as those are getting better each day.

How do you mitigate kids recording their parent's voices and playing them back to the AI?

That would be considered a "replay attack" and recorded audio carries a unique signature: BLOCKED

> I suspect if I was a kid that used a deep voice to say that I was an adult it would also fool it.

There should exist frequencies impossible to reach for anyone but post-pubescent men.

Of course that would make it teen-age verification at best.

What about women, though? Do they not get to age verify themselves? :P

Women also undergo voice change, just less pronounced.

Now the problem turns into being able to tell men from women.

EDIT: this of course isn't a serious proposition.

Then again I wonder what effect this would have implemented on e.g. a porn site. Women also watch porn, but with enough tuning I think it shouldn't produce too many false positives - if only due to the demographic of the users.

Surely the vocal cords and larynx of an adult woman are on average larger than those of a 10yo boy?

The AGEWARDEN system is ^^ agnostic and answers a simple question only: Is this human over or under 18?

From my research, each person is incredibly unique :)

> There should exist frequencies impossible to reach for anyone but post-pubescent men.... Of course that would make it teen-age verification at best.

Yes and no. Like geology, the more you dig into audio, the more is uncovered and available.

A child/teen with a deep voice has very unique perturbations that don't exist in other cohorts across feature sets. Adults may share some characteristics, but not at the levels found in specific age groups.

All good! Posting here to get the opinions and feedback from engineering peers.

> I... told it in a higher then normal voice that I was a kid, and it said I was under 18...

Good. If you're pretending to be a kid, you should be blocked. The launch is for sites that allow adults only (should have made that more clear in the post).

Deep voiced teens are THE HARDEST. What I commented earlier about the amount of data available in a clip of audio, that's real - teens have unique signatures that only show in their cohort.

Thanks for testing!

post puberty boys have absolutely have overlap with over 18 adults, if for no other reason then kids can go through puberty at different ages, so some 18 years olds have voices that are just dropping while others have had their voice drop for 6+ years.

You aren't going to be able to find a set of signatures that keeps out a useful number of <18s that doesn't also flag >18s

You are correct with inferring it's a scale, completely.

Politely disagree with "You aren't going to be able to find a set of signatures that keeps out a useful number..."

That's AGEWARDEN's job and the last year of my life has been diving deep into audio data to find those exact signals.

Good call out and thank you for the pushback :)

What do you consider the appropriate false negative/fall positive rate for voices of people aged 16-20? Since you don't give a confidence rating to the determination it's on the service to figure out what it's comfortable with.

(Not a lawyer, not an expert, just my possibly ignorant/wrong comment)

I checked around a bit more, and this seems to directly contradict the HN title:

https://agewarden.ai/customer-agreement

> AGEWARDEN is an age estimation tool. It does not verify identity and does not guarantee 100% accuracy. Customer is responsible for determining whether AGEWARDEN satisfies the legal requirements applicable to its business and jurisdiction.

Lawyers HIGHLY suggested the line; AGEWARDEN is > 95% accurate and on par with others in this space.

If someone told me they had 100% accuracy with inference, I'd call them out.

Thank YOU for calling it out :)

Reply on news.ycombinator.com